---
title: "Customiser Privacy Policy"
description: "How Customiser handles personal data: what we collect and why, who processes it, how long we keep it, how AI uses your documents, and your rights."
url: "https://customiser.ai/privacy"
modified: "2026-10-29"
---

# Privacy Policy

Last updated: 29 October 2026

## 1. Who we are

This policy explains how Customiser AI Ltd, a company registered in England and Wales under company number 16814294, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom ("Customiser", "we", "us"), handles personal data when you use our website (customiser.ai), our estimating and quoting software (app.customiser.ai, the "Service"), or contact us.

- We are the **controller** of personal data about our users, website visitors and business contacts: account details, billing, support and usage.
- We are a **processor** for personal data that our customers put into the Service as part of their content, such as contact details of their own customers or names printed on drawings. We process it only on our customer's instructions. If your data is in a customer's account, please contact that customer first.

Contact for anything in this policy: [team@customiser.ai](mailto:team@customiser.ai).

## 2. What we collect

- **Account details:** your name, email address, organisation name, role and sign-in information. We store your password only as a secure one-way hash, so no one at Customiser can read it.
- **Your content:** the documents you upload (drawings, bills of materials, specifications, requests for quotation, emails) and what the Service produces from them. This includes customer and supplier records you create, which can contain names, job titles, email addresses and phone numbers.
- **Billing information:** credit purchases, invoices and receipts. Card details are collected and held by our payment processor, not by us.
- **Usage and credits:** which features you use, the pages read and AI processing performed for each job, and the credits used.
- **Support and feedback:** messages you send us and, to help us answer, the page, job and app version you were on when you sent them.
- **Technical data:** IP address, browser and device information, logs and error reports, used to run and secure the website and the Service.
- **Demo bookings:** if you book a demo through the calendar on customiser.ai, your name, position, company, company email, country, phone number, industry, message and time zone, and any guests you add. The calendar is run by Cal.com, which passes the booking to us.
- **Website forms:** what you send through the forms on customiser.ai. That is your name, role, company, work email, country, phone number, industry and message if you request a demo; and, if you introduce a company through our referral programme, your name and email and the name, role, phone number and company of the person you introduce.

## 3. How we use it and our legal bases

- To provide the Service, run your account and process purchases (performance of our contract with you or your organisation).
- To keep the Service secure, prevent abuse and fix errors (our legitimate interests in running a safe, reliable service).
- To answer support requests and send service messages, such as receipts, security notices and notices of changes to our terms (contract and legitimate interests).
- To answer enquiries and demo requests sent through our website, to schedule and hold the demo calls you book, and to run our referral programme (our legitimate interests in responding to and building business relationships).
- To understand how the Service is used and improve it, using aggregated measurements that do not reveal your content (legitimate interests).
- To send product news, only where you have agreed or where the law otherwise allows; you can unsubscribe at any time (consent or legitimate interests).
- To meet our legal obligations, such as tax records and responding to lawful requests (legal obligation).

We do not sell personal data. We do not use your content for advertising, and we do not use your content to train artificial intelligence models.

If you introduce someone through our referral programme, please make sure they are happy for us to contact them. When we first get in touch, we tell them how we got their details.

## 4. How AI features handle your data

- When a task needs AI, we send the parts of your documents that the task requires (extracted text, and for scanned pages, page images) to our AI provider, Anthropic, and receive the result.
- Anthropic does not use this data to train its models, and handles it under its commercial terms.
- We keep a record of each AI step (the request, the result and a summary of the reasoning) for 90 days, so the Service can show why it suggested something and we can fix problems. The resulting suggestions and decisions stay with the job until the job is deleted.
- Our staff only look at these records to support you when you ask or allow us to, or where needed for security.
- Documents carrying export-control markings are held back from AI processing until an owner of the organisation reviews them.

## 5. Who we share data with

We use the providers below to run the Service. Each processes data only on our instructions, under a contract with data protection terms.

| Provider | What they do for us | Where |
| --- | --- | --- |
| Railway | Runs the application and document processing | United States |
| Vercel | Hosts and delivers the website, customiser.ai, and the web app, and counts website visits and measures page speed without cookies (Vercel Web Analytics and Speed Insights) | United States and global delivery network |
| Neon | Database and file storage | United States (AWS us-east-1) |
| Anthropic | AI processing | United States |
| PostHog | Product analytics, session replay, error monitoring and logs for the web app and customiser.ai | United States |
| Resend | Sending service emails | United States |
| Stripe | Payments for credit purchases | United States and Ireland |
| Google Workspace | Our business email, calendar and video calls (Google Meet) | United States |
| Cal.com | Runs the demo booking calendar on customiser.ai and sends booking emails | United States |
| Formspree | The contact and referral forms on customiser.ai | United States |

We may also share data with professional advisers, with a buyer or successor if our business is sold or reorganised (you will be told), or where the law requires it. We will update this list before adding a provider that processes customer content.

## 6. International transfers

Our providers store and process data mainly in the United States. When we transfer personal data from the United Kingdom or the European Economic Area, we rely on the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses, or on the provider's certification under the Data Privacy Framework, where applicable.

## 7. How long we keep data

- **Your content and jobs:** until you delete the job or your organisation's account. Owners can also set a shorter retention period for documents in Settings.
- **When an organisation's account is closed:** we keep its data for 30 days in case the closure was a mistake, then permanently delete its database records and files.
- **AI step records:** 90 days.
- **Account details:** while the account is active, then deleted with the organisation.
- **Audit logs of important actions** (for example who approved a quote): kept for security and accountability. Customer and company names in them are stored only as irreversible codes.
- **Billing records:** for as long as tax law requires (currently six years in the UK).
- **Support messages:** 24 months.
- **Website enquiries, demo bookings and referrals:** 24 months from our last contact, unless they lead to a customer relationship.
- **Technical logs and error reports:** up to 90 days.
- **Backups:** deleted data can remain in our providers' backups for up to 30 days before it is overwritten.

## 8. Security

- Data is encrypted in transit (TLS) and encrypted at rest by our hosting providers.
- Each organisation's data is separated by access rules enforced in the database itself, so one organisation cannot read another's data even if an application query is wrong.
- Access is limited by role, and important actions are recorded in an audit log.

No system is completely secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

## 9. Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to our use of it, receive a copy in a portable format, and withdraw consent at any time. California residents have the right to know what we collect, to delete it, and not to be discriminated against for using these rights; we do not sell or share personal data for cross-context behavioural advertising.

To use your rights, email [team@customiser.ai](mailto:team@customiser.ai). We will reply within 30 days. For personal data in a customer's account (where we are a processor), we will pass your request to that customer and help them answer it.

## 10. Cookies

The web app, app.customiser.ai, uses the cookies it needs to keep you signed in and secure, and PostHog's analytics cookie, which helps us see how the web app is used and fix problems. PostHog also records how you use the web app's pages so we can find and fix problems, with anything you type and all document content hidden. These are part of providing the Service, so the web app does not show a cookie banner; by using it you accept them. Our website, customiser.ai, uses no advertising or marketing cookies. It counts visits with PostHog without cookies unless you accept analytics cookies in the banner; if you do, PostHog sets a cookie that links your visits, including to the web app, and records how you use the pages, with anything typed into a form hidden. You can change your choice by clearing the site's cookies. Our host, Vercel, also counts page views and measures how fast pages load with Vercel Web Analytics and Speed Insights, which use no cookies and do not identify you. The booking calendar on our contact page is provided by Cal.com and loads from its servers, on that page only. Cal.com sets the cookies and similar storage it needs to run the booking form, such as a security token and a bot-protection cookie; its privacy policy has the details.

## 11. Children

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children.

## 12. Changes to this policy

We will post any changes on this page and update the date above. If a change is significant, we will also tell organisation owners by email or in the Service.

## 13. Contact and complaints

Email [team@customiser.ai](mailto:team@customiser.ai), or write to Customiser AI Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. If you are not satisfied with our answer, you can complain to your data protection authority. In the UK, that is the Information Commissioner's Office ([ico.org.uk](https://ico.org.uk)).